B1: data-migration engine (MigrateAll + MigrateApp) + backup mutual-exclusion

internal/stacks/migrate.go: crash-safe, resumable namespace migration over the
controller's /mnt RW mount. Two entry points (whole-namespace + per-app) share one
journaled pipeline: validate -> stop -> copy (rsync -a --checksum, additive; conflict-
merge walk for non-app content) -> verify -> flip+redeploy (RedeployFromEnv) -> cleanup.
CLEANUP (the only destructive step) is gated on all units verified AND all apps
redeployed. Single-flight; mutual exclusion with the backup orchestrator (Change 3).
Non-hollow tests incl. mutation-proven collision + cleanup-gate companions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/backup/migration_exclusion_test.go

@@ -0,0 +1,38 @@
+package backup
+
+import (
+	"context"
+	"io"
+	"log"
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/config"
+)
+
+// TestRunDBDumps_SkippedWhileMigrating asserts the scheduled DB-dump path SKIPS when a migration is
+// active (Change 3 — backup ↔ migration mutual exclusion), rather than racing the migration. The
+// companion: without the migrationActive guard, RunDBDumps would proceed (and a non-nil migration
+// check would not matter) — this test FAILS because lastDBDump would be set / discovery attempted.
+func TestRunDBDumps_SkippedWhileMigrating(t *testing.T) {
+	cfg := &config.Config{}
+	cfg.Paths.SystemDataPath = "/mnt/sys_drive"
+	m := NewManager(cfg, nil, log.New(io.Discard, "", 0))
+	m.SetMigrationRunningCheck(func() bool { return true })
+
+	if err := m.RunDBDumps(context.Background()); err != nil {
+		t.Fatalf("RunDBDumps should skip cleanly, got %v", err)
+	}
+	// Skipped before runDBDumpsInternal → no status recorded and the running flag never taken.
+	if m.lastDBDump != nil {
+		t.Errorf("DB dump ran despite an active migration (lastDBDump set)")
+	}
+	if m.IsRunning() {
+		t.Errorf("running flag left set after a skipped dump")
+	}
+
+	// With no migration active, the guard does not block (it proceeds into discovery).
+	m.SetMigrationRunningCheck(func() bool { return false })
+	if m.migrationActive() {
+		t.Errorf("migrationActive should be false when the check returns false")
+	}
+}